Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

A malicious npm package, jscrambler 8.14.0, was released with a hidden infostealer that silently dropped and executed during installation. The package, pushed by a compromised account, included a Rust-based stealer targeting developer machines and their cloud credentials, crypto wallets, and AI tool API keys. The attack exploited a vulnerability in npm where older clients continued to run preinstall hooks, allowing the stealer to be installed even after npm updated to a version that disabled them. While the package has been replaced with 8.15.0, any systems still using 8.14.0 are at risk.